CVE-2024-44082

What it actually does

A crafted image supplied by an authenticated user can trigger undesired behaviors in qemu-img during image processing, resulting in unauthorized access to potentially sensitive data.

Why it matters to the business

Organizations running affected OpenStack deployments face risk of sensitive data exposure through authenticated user actions, with low but present likelihood given stable EPSS and no known exploitation campaigns.

How an attack unfolds

An authenticated user supplies a maliciously crafted disk image to the Ironic image processing workflow, which invokes qemu-img and exploits its handling to leak data; no named threat actors or ransomware usage reported.

How to fix it

Upgrade Ironic to version 26.0.1 or later and ironic-python-agent to 9.13.1 or later, applying the branch-specific fixes: Ironic <21.4.3 to >=21.4.3, >=22.0.0 <23.0.2 to >=23.0.2, >=23.1.0 <24.1.2 to >=24.1.2, >=25.0.0 <26.0.1 to >=26.0.1; ironic-python-agent equivalent branches to >=9.4.2, >=9.7.1, >=9.11.1, >=9.13.1.

How to confirm the fix worked

Confirm deployed Ironic and ironic-python-agent versions match or exceed the fixed releases for each branch; test image processing with known-safe images to verify no unexpected qemu-img behavior.

Typical attack path

1. Obtain authenticated access to the Ironic API
2. Upload a specially crafted image file
3. Trigger image processing via qemu-img
4. Observe or access leaked sensitive data

How to detect it

Review Ironic API and qemu-img process logs for anomalous image uploads or processing events that result in unexpected file or memory access patterns; no specific threat actor TTPs documented.

What your security team should do

• Apply the listed version upgrades across all affected branches without delay
• Restrict image upload privileges to least-privilege authenticated users
• Monitor EPSS and KEV status for any future changes despite current low scores